summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2017-04-05Shuffle sendhup() into dispatch.c, the only place it is used.Kenneth R Westerback
2017-04-05various improvements, from klemens nanni;Jason McIntyre
i've omitted hunk 3 of his diff, as what's there now is correct; ok mikeb
2017-04-04Send a RTM_PROPOSAL to clear out other dhclient instances on startup.Kenneth R Westerback
Replaces forcing interface link state down and up to generate RTM_IFINFO messages.
2017-04-04Treat SSID's like the 0 to 32 bytes of uint8_t data that they reallyKenneth R Westerback
are. Track and use the actual lengths and use memcpy()/memcmp() instead of strcmp()/strdup().
2017-04-03warn format string should be literal.Frederic Cambus
OK deraadt@, millert@
2017-04-03Change parse_string() to take an optional integer pointer that canKenneth R Westerback
be used to return the final size of the parsed (i.e. un-vis'ed) string. Use same, plus memcpy() to ensure entire final string is copied to intended destination even if there are embedded NULs.
2017-04-03Simplify read_string() to just read the characters between the '"'s.Kenneth R Westerback
Push the un-vising up to parse_string(). This allows both the actual string and the un-vised version to be available as desired. Use memcpy() instead of strdup() to copy un-vised string since it may legitimately contain NUL.
2017-04-03Tweak parse_string() to not consume the ';'. Simplifies/shortensKenneth R Westerback
some logic.
2017-04-03Tweak 'expecting' parse_warn() messages to be more consistent.Kenneth R Westerback
2017-04-02Check return value of asprintf(), and don't use 0 as a char *Tom Cosgrove
Started by, and ok, deraadt@
2017-04-02Change parse_string() warning from "filename must be a string" toKenneth R Westerback
"expecting a string". Things other than filenames are parsed here.
2017-03-30Only close the SA if an error happens before ikev2_msg_init() was calledPatrick Wildt
to make sure we do not run ikev2_msg_cleanup() on an unitialized stack variable. ok deraadt@ reyk@
2017-03-28Add helpful debug messages to tell us why public key authentication failed.Reyk Floeter
This is currently only visible in debug mode (eg. iked -dvv), some debug messages will be turned into regular warnings later. OK claudio@ deraadt@
2017-03-28Remove RSA from the list of keywords, lookup is now done in a table.Reyk Floeter
This lets us configure explicit old-style RSA again. OK mikeb@
2017-03-28Don't send informational responses before we're having the key material.Reyk Floeter
iked starts sending keepalive messages after authentication and after successfully completing the handshake. Other implementations, like we've seen on Microsoft Azure, start sending keepalive messages right after receiving the first SA_INIT message when they set up the key material, even before we received the SA_INIT response to complete the DH exchange. The solution is to ignore early keepalive messages before we're ready to encrypt our response, in the transition between SA_INIT and AUTH. The peer should still accept one or more missed keepalives. OK mikeb@
2017-03-28Returning -1 in an imsg handler like ikev2_dispatch_cert aborts iked.Reyk Floeter
-1 means "I didn't handle or know this imsg", it should not be used to indicate an application error in this context. OK mikeb@
2017-03-27rather than printing the wrong function name, dont print it at all.Sebastian Benoit
found by Klemens Nanni
2017-03-27Don't cache the DH group in the policyMike Belopuhov
When tearing IKE SA down, the DH group referred by it is destroyed, however it remains cached in the policy. With the introduction of IKE SA rekeying we have extended the life of this dangling pointer by reusing it on new SAs. So instead of caching the pointer in the policy we can store the DH group ID and create a DH group on demand using this parameter if it's specified. With and OK reyk
2017-03-27correct verb pattern;Jason McIntyre
2017-03-27Factor out flows into separate configuration messagesMike Belopuhov
We reach an imsg payload limit with just a few traffic selectors so in order to load more we need to split them up and send separately. Suggested and OK reyk
2017-03-27spacingReyk Floeter
2017-03-27Fix another iked leak of SAs in pfkey_sa(), copy tags correctly.Reyk Floeter
Diff from markus@ OK mikeb@ patrick@
2017-03-27Add support to reflect the responder IKEv2 COOKIE.Reyk Floeter
This fixes connecting to Azure VPN and other implementations that implement the IKEv2 COOKIE mechanism on the responder side. Azure decides to send you a responder COOKIE after too many connection attempts - we have to keep it and reflect it to establish a connection. This implementation is only for the initiator (client) side, we do not support sending COOKIEs on the responder (server) side yet. OK patrick@ mikeb@
2017-03-27Add support for RFC4754 (ECDSA) and RFC7427 authentication.Reyk Floeter
These modes provide stronger and more flexible ways for authentication: while RSA public key auth relies on SHA-1 hashes, the news modes use SHA2-256 and up to SHA2-512 hashes. Original diff from markus@ with patches from mikeb@ and me. OK mikeb@ patrick@
2017-03-26Fix dhclient vis/unvis of strings stored in the leases file.Kenneth R Westerback
Replaces incorrect manual emulation of vis() for single, double and back quotes, dollar signs and back slashes. Just use vis() with VIS_ALL for these characters. Should fix problem reported by robert@ with ssid's containing back slash.
2017-03-26cleanup fdisk(8) partition names used by FAT file systems so they are moreIgor Sobrado
consistent and easier to identify, as outlined here: - FAT12: FAT12 (01h) - FAT16: FAT16S (04h), FAT16B (06h), FAT16L (0Eh) - FAT32: FAT32 (0Bh), FAT32L (0Ch) nothing in our tree is looking to the strings being replaced for anything but printing them out, only to the numerical ids taken from disklabel.h ok krw@, jmc@
2017-03-23Fix printf() incantation for non-NULL terminated string.Kenneth R Westerback
Pointed out by florian@. ok bluhm@
2017-03-23set ps_noaction to not fork uneeded children when checking config with -nJonathan Gray
ok mikeb@ reyk@
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-21Replace a magic number with the corresponding macro from ieee80211_ioctl.h.Stefan Sperling
No functional change. ok deraadt@ tb@
2017-03-21getnameinfo errors should go to stderr & should print what's going on.Florian Obser
Pointed out by & ok bluhm While here print prefixlen with %u, pointed out by bluhm, too.
2017-03-20show inet6 proposals in route monitorFlorian Obser
fine with krw@
2017-03-20stop signposting; while here, knock out the comments;Jason McIntyre
2017-03-20as suggested by mpi, be less particular documentingJason McIntyre
where router adverts are coming from when describing autoconf; rework the description a little; ok mpi
2017-03-19"autoconf" belongs in the inet6 section, not the global options part;Jason McIntyre
while here prefer "interface" over "ip6-interface" and show that "inet6" is mandatory; ok florian mpi
2017-03-16remove the list of available sysctls: the sysctls are fullyJason McIntyre
described in sysctl(3) and a list of available sysctls on any particular machine is best retrieved using sysctl; text tweaked by schwarze ok bluhm millert deraadt schwarze
2017-03-16Fix a regression preventing ``kern.profiling'' to return the profilingMartin Pieuchot
state even with a correct kernel. Reported by jmc@, ok tb@
2017-03-13Resolve simultaneous Child SA rekeyingMike Belopuhov
From and OK markus, OK reyk
2017-03-13Resolve simultaneous IKE SA rekeyingMike Belopuhov
From and OK markus, OK reyk
2017-03-13Make sure that proposal contains a DH group when rekeying with PFS enabledReyk Floeter
Via markus, OK mikeb@
2017-03-13NAT-T improvementsReyk Floeter
Move repeated creation of the NAT-T payload into a function, remove erroneous msg_offset, and improve NAT-T handling. From and OK markus, OK mikeb
2017-03-13Don't rekey acquired Child SAsMike Belopuhov
From and OK markus, OK reyk
2017-03-13Clarify iked.conf(5) manpage in regards to IP compression.Patrick Wildt
ok markus@ reyk@
2017-03-13When setting up IPcomp flows for the networks 'A' and 'B' betweenPatrick Wildt
gateways 'a' and 'b', we replace the ESP flow "A->B ESP" with an IPCOMP flow "A->B IPCOMP" and add a matching (transport mode) ESP flow between the gateways "a->b ESP". The later is now marked with flow_ipcomp so it is not translated into "a->b IPCOMP" on rekeying. When SAs get deleted we do an extra loop to figure out if matching IPcomp SAs can now be removed, too. This allows faster expiry of unused IPcomp SAs. Disable bytes lifetime for IP compression. ok markus@ reyk@
2017-03-13When freeing a Child SA make sure it's peer no longer points to itMike Belopuhov
From and OK markus, OK reyk
2017-03-13Fix and improve the IKE SA rekeying timeout, add a randomized jitter.Reyk Floeter
Diff from markus@ with a small tweak from me. OK mikeb@ patrick@
2017-03-13Improve reporting of authentication errorsMike Belopuhov
From and OK markus, OK reyk
2017-03-13flow_cmp() must compare the same flow-attributes as the kernel,Patrick Wildt
otherwise we never can keep the in-daemon and the in-kernel idea of flows in sync and iked ends up deleting flows that are still in use. Make use of flow_cmp() and a new flow_equal() instead of handcrafting the compare in an if. ok markus@ reyk@
2017-03-13We need to call policy_ref() for policies that have refcountingPatrick Wildt
enabled. Refcounting is enabled when a policy is removed during 'ikectl reload' and still has SAs point to it. On IKESA rekeying such a policy will be referenced by the new IKESA, so we need to adjust the refcount -- otherwise the policies get free()d too early and we will crash at some point. ok markus@ mikeb@ reyk@
2017-03-12Make ifconfig scan display both wpa1 and wpa2 if both are supported.Stefan Sperling
ok henning@ phessler@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 06:34:37 +0000